Revert "[es2015] Introduce JSDataView::external_pointer."

This reverts commit 46573e51.

Reason for revert: Speculative revert for breaking chromium integration.

Might break gpu tests and linux debug:
https://ci.chromium.org/p/v8/builders/luci.v8.ci/Mac%20V8%20FYI%20Release%20(Intel)/2554

Also blocks the roll:
https://chromium-review.googlesource.com/c/chromium/src/+/1234328

Original change's description:
> [es2015] Introduce JSDataView::external_pointer.
> 
> This adds a new external_pointer field to every JSDataView instance
> which points directly into the backing store at the given view's
> byte_offset. This was the DataView performance is now almost on
> par with the TypedArray performance for accessing aligned memory
> (with appropriate endianess). This also serves as prepatory work
> to enable full 64-bit addressing of DataView backing stores in
> optimized code (soonish).
> 
> This change optimizes the bounds checking sequence in TurboFan in
> such a way that it further improves the DataView set/get performance
> by around 10%, almost closing the remaining gap between DataViews
> and TypedArrays.
> 
> Drive-by-fix: Get rid of the code duplication around DataView inlining
> in the JSCallReducer and have only a single bottleneck method now.
> 
> Bug: chromium:225811, v8:4153, v8:7881, v8:8171
> Change-Id: I9118efd4d19e93f0e51c931a9bec1a56a0f4593e
> Reviewed-on: https://chromium-review.googlesource.com/1231994
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56042}

TBR=yangguo@chromium.org,mlippautz@chromium.org,tebbi@chromium.org,bmeurer@chromium.org

Change-Id: I614a90043b1574b19936c37987db94806cac3bd7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:225811, v8:4153, v8:7881, v8:8171
Reviewed-on: https://chromium-review.googlesource.com/1234417Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56059}

src/builtins/builtins-dataview.cc

@@ -101,8 +101,6 @@ BUILTIN(DataViewConstructor) {
 
   // 13. Set O's [[ByteOffset]] internal slot to offset.
   Handle<JSDataView>::cast(result)->set_byte_offset(view_byte_offset);
-  Handle<JSDataView>::cast(result)->set_external_pointer(
-      static_cast<uint8_t*>(array_buffer->backing_store()) + view_byte_offset);
 
   // 14. Return O.
   return *result;

src/code-stub-assembler.cc

@@ -12263,12 +12263,6 @@ TNode<UintPtrT> CodeStubAssembler::LoadJSArrayBufferViewByteOffset(
                                    JSArrayBufferView::kByteOffsetOffset);
 }
 
-TNode<RawPtrT> CodeStubAssembler::LoadJSDataViewExternalPointer(
-    TNode<JSDataView> data_view) {
-  return LoadObjectField<RawPtrT>(data_view,
-                                  JSDataView::kExternalPointerOffset);
-}
-
 TNode<Smi> CodeStubAssembler::LoadJSTypedArrayLength(
     TNode<JSTypedArray> typed_array) {
   return LoadObjectField<Smi>(typed_array, JSTypedArray::kLengthOffset);

src/code-stub-assembler.h

@@ -2789,9 +2789,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
       SloppyTNode<Context> context, TNode<JSArrayBufferView> array_buffer_view,
       const char* method_name);
 
-  // JSDataView helpers
-  TNode<RawPtrT> LoadJSDataViewExternalPointer(TNode<JSDataView> data_view);
-
   // JSTypedArray helpers
   TNode<Smi> LoadJSTypedArrayLength(TNode<JSTypedArray> typed_array);
 

src/compiler/access-builder.cc

@@ -375,18 +375,6 @@ FieldAccess AccessBuilder::ForJSArrayBufferViewByteOffset() {
   return access;
 }
 
-// static
-FieldAccess AccessBuilder::ForJSDataViewExternalPointer() {
-  FieldAccess access = {kTaggedBase,
-                        JSDataView::kExternalPointerOffset,
-                        MaybeHandle<Name>(),
-                        MaybeHandle<Map>(),
-                        Type::ExternalPointer(),
-                        MachineType::Pointer(),
-                        kNoWriteBarrier};
-  return access;
-}
-
 // static
 FieldAccess AccessBuilder::ForJSTypedArrayLength() {
   FieldAccess access = {kTaggedBase,

src/compiler/access-builder.h

@@ -130,9 +130,6 @@ class V8_EXPORT_PRIVATE AccessBuilder final
   // Provides access to JSArrayBufferView::byteOffset() field.
   static FieldAccess ForJSArrayBufferViewByteOffset();
 
-  // Provides access to JSDataView::external_pointer() field.
-  static FieldAccess ForJSDataViewExternalPointer();
-
   // Provides access to JSTypedArray::length() field.
   static FieldAccess ForJSTypedArrayLength();
 

src/compiler/js-call-reducer.h

@@ -182,9 +182,6 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
                                           InstanceType instance_type,
                                           FieldAccess const& access);
 
-  enum class DataViewAccess { kGet, kSet };
-  Reduction ReduceDataViewAccess(Node* node, DataViewAccess access,
-                                 ExternalArrayType element_type);
   Reduction ReduceDataViewPrototypeGet(Node* node,
                                        ExternalArrayType element_type);
   Reduction ReduceDataViewPrototypeSet(Node* node,

src/heap/concurrent-marking.cc

@@ -188,11 +188,7 @@ class ConcurrentMarkingVisitor final
     return VisitJSObjectSubclass(map, object);
   }
 
-  int VisitJSDataView(Map* map, JSDataView* object) {
-    return VisitJSObjectSubclass(map, object);
-  }
-
-  int VisitJSTypedArray(Map* map, JSTypedArray* object) {
+  int VisitJSArrayBufferView(Map* map, JSArrayBufferView* object) {
     return VisitJSObjectSubclass(map, object);
   }
 

src/heap/objects-visiting.h

@@ -21,9 +21,8 @@ class BigInt;
 class BytecodeArray;
 class DataHandler;
 class JSArrayBuffer;
-class JSDataView;
+class JSArrayBufferView;
 class JSRegExp;
-class JSTypedArray;
 class JSWeakCollection;
 class UncompiledDataWithoutPreParsedScope;
 class UncompiledDataWithPreParsedScope;
@@ -46,9 +45,8 @@ class UncompiledDataWithPreParsedScope;
   V(FixedFloat64Array)                   \
   V(FixedTypedArrayBase)                 \
   V(JSArrayBuffer)                       \
-  V(JSDataView)                          \
+  V(JSArrayBufferView)                   \
   V(JSObject)                            \
-  V(JSTypedArray)                        \
   V(JSWeakCollection)                    \
   V(Map)                                 \
   V(Oddball)                             \

src/objects-body-descriptors-inl.h

@@ -228,51 +228,24 @@ class JSArrayBuffer::BodyDescriptor final : public BodyDescriptorBase {
   }
 };
 
-class JSDataView::BodyDescriptor final : public BodyDescriptorBase {
+class JSArrayBufferView::BodyDescriptor final : public BodyDescriptorBase {
  public:
   STATIC_ASSERT(kBufferOffset + kPointerSize == kByteOffsetOffset);
   STATIC_ASSERT(kByteOffsetOffset + kUIntptrSize == kByteLengthOffset);
-  STATIC_ASSERT(kByteLengthOffset + kUIntptrSize == kExternalPointerOffset);
-  STATIC_ASSERT(kExternalPointerOffset + kPointerSize == kSize);
+  STATIC_ASSERT(kByteLengthOffset + kUIntptrSize == kHeaderSize);
 
   static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
     if (offset < kByteOffsetOffset) return true;
-    if (offset < kSize) return false;
-    return IsValidSlotImpl(map, obj, offset);
-  }
-
-  template <typename ObjectVisitor>
-  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
-                                 ObjectVisitor* v) {
-    // JSDataView instances contain raw data that the GC does not know about.
-    IteratePointers(obj, kPropertiesOrHashOffset, kByteOffsetOffset, v);
-    IterateBodyImpl(map, obj, kSize, object_size, v);
-  }
-
-  static inline int SizeOf(Map* map, HeapObject* object) {
-    return map->instance_size();
-  }
-};
-
-class JSTypedArray::BodyDescriptor final : public BodyDescriptorBase {
- public:
-  STATIC_ASSERT(kBufferOffset + kPointerSize == kByteOffsetOffset);
-  STATIC_ASSERT(kByteOffsetOffset + kUIntptrSize == kByteLengthOffset);
-  STATIC_ASSERT(kByteLengthOffset + kUIntptrSize == kLengthOffset);
-  STATIC_ASSERT(kLengthOffset + kPointerSize == kSize);
-
-  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
-    if (offset < kByteOffsetOffset) return true;
-    if (offset < kSize) return false;
+    if (offset < kHeaderSize) return false;
     return IsValidSlotImpl(map, obj, offset);
   }
 
   template <typename ObjectVisitor>
   static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
-    // JSTypedArray instances contain raw data that the GC does not know about.
+    // JSArrayBufferView contains raw data that the GC does not know about.
     IteratePointers(obj, kPropertiesOrHashOffset, kByteOffsetOffset, v);
-    IterateBodyImpl(map, obj, kSize, object_size, v);
+    IterateBodyImpl(map, obj, kHeaderSize, object_size, v);
   }
 
   static inline int SizeOf(Map* map, HeapObject* object) {

src/objects.cc

@@ -3161,10 +3161,8 @@ VisitorId Map::GetVisitorId(Map* map) {
       return kVisitJSArrayBuffer;
 
     case JS_DATA_VIEW_TYPE:
-      return kVisitJSDataView;
-
     case JS_TYPED_ARRAY_TYPE:
-      return kVisitJSTypedArray;
+      return kVisitJSArrayBufferView;
 
     case SMALL_ORDERED_HASH_MAP_TYPE:
       return kVisitSmallOrderedHashMap;

src/objects/js-array-buffer-inl.h

@@ -33,7 +33,7 @@ void* JSArrayBuffer::backing_store() const {
   return reinterpret_cast<void*>(ptr);
 }
 
-void JSArrayBuffer::set_backing_store(void* value) {
+void JSArrayBuffer::set_backing_store(void* value, WriteBarrierMode mode) {
   intptr_t ptr = reinterpret_cast<intptr_t>(value);
   WRITE_INTPTR_FIELD(this, kBackingStoreOffset, ptr);
 }
@@ -184,16 +184,6 @@ MaybeHandle<JSTypedArray> JSTypedArray::Validate(Isolate* isolate,
 ACCESSORS(JSTypedArray, raw_length, Object, kLengthOffset)
 #endif
 
-void* JSDataView::external_pointer() const {
-  intptr_t ptr = READ_INTPTR_FIELD(this, kExternalPointerOffset);
-  return reinterpret_cast<void*>(ptr);
-}
-
-void JSDataView::set_external_pointer(void* value) {
-  intptr_t ptr = reinterpret_cast<intptr_t>(value);
-  WRITE_INTPTR_FIELD(this, kExternalPointerOffset, ptr);
-}
-
 }  // namespace internal
 }  // namespace v8
 

src/objects/js-array-buffer.h

@@ -32,7 +32,7 @@ class JSArrayBuffer : public JSObject {
   DECL_PRIMITIVE_ACCESSORS(byte_length, size_t)
 
   // [backing_store]: backing memory for this array
-  DECL_PRIMITIVE_ACCESSORS(backing_store, void*)
+  DECL_ACCESSORS(backing_store, void)
 
   // For non-wasm, allocation_length and allocation_base are byte_length and
   // backing_store, respectively.
@@ -156,6 +156,10 @@ class JSArrayBufferView : public JSObject {
   static const int kByteLengthOffset = kByteOffsetOffset + kUIntptrSize;
   static const int kHeaderSize = kByteLengthOffset + kUIntptrSize;
 
+  // Iterates all fields in the object including internal ones except
+  // kByteOffset and kByteLengthOffset.
+  class BodyDescriptor;
+
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(JSArrayBufferView);
 };
@@ -194,10 +198,6 @@ class JSTypedArray : public JSArrayBufferView {
   static const int kSizeWithEmbedderFields =
       kSize + v8::ArrayBufferView::kEmbedderFieldCount * kPointerSize;
 
-  // Iterates all fields in the object including internal ones except
-  // kByteOffsetOffset, kByteLengthOffset and kLengthOffset.
-  class BodyDescriptor;
-
  private:
   static Handle<JSArrayBuffer> MaterializeArrayBuffer(
       Handle<JSTypedArray> typed_array);
@@ -210,25 +210,16 @@ class JSTypedArray : public JSArrayBufferView {
 
 class JSDataView : public JSArrayBufferView {
  public:
-  // [external_pointer]: Points into the actual backing store at the
-  // byte offset of this data view.
-  DECL_PRIMITIVE_ACCESSORS(external_pointer, void*)
-
   DECL_CAST(JSDataView)
 
   // Dispatched behavior.
   DECL_PRINTER(JSDataView)
   DECL_VERIFIER(JSDataView)
 
-  static const int kExternalPointerOffset = JSArrayBufferView::kHeaderSize;
-  static const int kSize = kExternalPointerOffset + kPointerSize;
+  static const int kSize = JSArrayBufferView::kHeaderSize;
   static const int kSizeWithEmbedderFields =
       kSize + v8::ArrayBufferView::kEmbedderFieldCount * kPointerSize;
 
-  // Iterates all fields in the object including internal ones except
-  // kByteOffsetOffset, kByteLengthOffset and kExternalPointerOffset.
-  class BodyDescriptor;
-
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(JSDataView);
 };

src/objects/map.h

@@ -37,10 +37,9 @@ namespace internal {
   V(FreeSpace)                           \
   V(JSApiObject)                         \
   V(JSArrayBuffer)                       \
-  V(JSDataView)                          \
+  V(JSArrayBufferView)                   \
   V(JSObject)                            \
   V(JSObjectFast)                        \
-  V(JSTypedArray)                        \
   V(JSWeakCollection)                    \
   V(Map)                                 \
   V(NativeContext)                       \

src/snapshot/deserializer.cc

@@ -241,13 +241,6 @@ HeapObject* Deserializer<AllocatorT>::PostProcessNewObject(HeapObject* obj,
       buffer->set_backing_store(backing_store);
       isolate_->heap()->RegisterNewArrayBuffer(buffer);
     }
-  } else if (obj->IsJSDataView()) {
-    // Fixup the JSDataView::external_pointer field.
-    JSDataView* data_view = JSDataView::cast(obj);
-    JSArrayBuffer* buffer = JSArrayBuffer::cast(data_view->buffer());
-    data_view->set_external_pointer(
-        reinterpret_cast<uint8_t*>(buffer->backing_store()) +
-        data_view->byte_offset());
   } else if (obj->IsFixedTypedArrayBase()) {
     FixedTypedArrayBase* fta = FixedTypedArrayBase::cast(obj);
     // Only fixup for the off-heap case.

src/snapshot/serializer.cc

@@ -708,15 +708,6 @@ void Serializer<AllocatorT>::ObjectSerializer::SerializeContent(Map* map,
     object_->IterateBody(map, size, this);
     // Finally skip to the end.
     serializer_->FlushSkip(SkipTo(object_->address() + size));
-  } else if (object_->IsJSDataView()) {
-    // JSDataView::external_pointer() contains a raw pointer. Change it
-    // to nullptr for serialization to keep the snapshot predictable.
-    JSDataView* data_view = JSDataView::cast(object_);
-    void* external_pointer = data_view->external_pointer();
-    data_view->set_external_pointer(nullptr);
-    object_->IterateBody(map, size, this);
-    OutputRawData(object_->address() + size);
-    data_view->set_external_pointer(external_pointer);
   } else {
     // For other objects, iterate references first.
     object_->IterateBody(map, size, this);